Because assumptions made to analyze the privacy of DP-SGD appear conservative, researchers
often conjecture that the privacy afforded by DP-SGD is significantly
stronger than what can be proven.
For example, Carlini et al. [1]} argue (and provide some evidence)
that training language models with \(\varepsilon =10^5\) -DP might be safe in practice despite this
offering no theoretical guarantees. In other words, it is assumed that there is a gap between the lower bound an adversary may achieve when attacking the training algorithm and the upper bound established through the analysis.
